CVE-2026-70722 Overview
CVE-2026-70722 is a high-severity vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite, specifically in the Internal Operations component. The flaw affects supported versions 12.2.3 through 12.2.15. An unauthenticated remote attacker can exploit the issue over HTTPS without user interaction. Successful exploitation allows unauthorized creation, deletion, or modification of critical data and can trigger a partial denial of service. The weakness is categorized under CWE-284: Improper Access Control.
Critical Impact
Unauthenticated network attackers can tamper with all Oracle Advanced Inbound Telephony data and degrade service availability without any user interaction.
Affected Products
- Oracle E-Business Suite - Oracle Advanced Inbound Telephony 12.2.3
- Oracle E-Business Suite - Oracle Advanced Inbound Telephony 12.2.4 through 12.2.14
- Oracle E-Business Suite - Oracle Advanced Inbound Telephony 12.2.15
Discovery Timeline
- 2026-08-18 - CVE-2026-70722 published to NVD
- 2026-08-20 - Last updated in NVD database
Technical Details for CVE-2026-70722
Vulnerability Analysis
The vulnerability resides in the Internal Operations component of Oracle Advanced Inbound Telephony, a module within Oracle E-Business Suite that handles inbound customer interaction routing. The flaw allows an unauthenticated attacker with network reachability to the exposed HTTPS interface to manipulate data managed by the module. Attackers can create, modify, or delete records that the application treats as authoritative. The same access path also permits partial disruption of the telephony service. Because no credentials or user interaction are required, the vulnerability is well suited for opportunistic scanning against internet-facing E-Business Suite deployments.
Root Cause
The issue is an improper access control weakness [CWE-284]. Oracle Advanced Inbound Telephony does not adequately restrict which callers may invoke sensitive operations in the Internal Operations component. Authorization checks that should gate data modification and administrative actions are either missing or incorrectly enforced, allowing unauthenticated requests to reach protected functionality.
Attack Vector
The attack vector is network-based over HTTPS against an exposed Oracle E-Business Suite instance. An attacker sends crafted requests directly to the vulnerable Advanced Inbound Telephony endpoints. Because authentication is not required, exploitation only depends on network reachability and knowledge of the affected endpoints. No verified public proof-of-concept code is available at the time of this writing. Refer to the Oracle Security Alert for authoritative technical detail.
Detection Methods for CVE-2026-70722
Indicators of Compromise
- Unauthenticated HTTPS requests targeting Oracle Advanced Inbound Telephony URLs within the /OA_HTML/ and Internal Operations request paths.
- Unexpected creation, deletion, or modification events in Advanced Inbound Telephony database tables without a corresponding authenticated user session.
- Application or middle-tier errors indicating partial service degradation of the inbound telephony listener.
Detection Strategies
- Inspect Oracle HTTP Server and WebLogic access logs for anomalous request bursts against Advanced Inbound Telephony endpoints from external or non-CTI source IPs.
- Correlate database audit records for IEC, IEO, and related telephony schema objects with authenticated user sessions to identify orphaned writes.
- Baseline normal call-center traffic patterns and alert on volume or method deviations, including unusual POST requests to Internal Operations handlers.
Monitoring Recommendations
- Enable Oracle E-Business Suite Sign-On Audit and database Fine-Grained Auditing on Advanced Inbound Telephony tables.
- Forward web tier, middle tier, and database audit logs to a centralized SIEM for cross-layer correlation.
- Alert on any successful requests to Internal Operations endpoints that originate from outside the trusted contact-center network segment.
How to Mitigate CVE-2026-70722
Immediate Actions Required
- Apply the fixes published in the Oracle Critical Patch Update referenced in the Oracle Security Alert for August 2026.
- Inventory all Oracle E-Business Suite instances running versions 12.2.3 through 12.2.15 and confirm whether Oracle Advanced Inbound Telephony is deployed and reachable.
- Restrict internet exposure of E-Business Suite web tiers and require VPN or zero-trust access for administrative and telephony components.
Patch Information
Oracle addresses this vulnerability in the August 2026 security alert. Administrators should download and apply the relevant patch set for their deployed E-Business Suite 12.2.x release as documented in the Oracle Security Alert. Validate patch application in a non-production environment before rollout and re-run Oracle's patch verification utilities post-installation.
Workarounds
- If patching cannot be performed immediately, block external access to Advanced Inbound Telephony URLs at the reverse proxy or web application firewall.
- Disable the Advanced Inbound Telephony responsibility and associated services on hosts that do not require it.
- Enforce network segmentation so that only trusted CTI middleware and internal call-center systems can reach the vulnerable endpoints.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
